April 6, 1999 Web posted at: 2:42 p.m. EDT (1842 GMT) by Ellen Messmer

From...

INTERACTIVE

How should the U.S. and NATO respond to pro-Serbian hackers?    Offensively (a hack for a hack)    Defensively (secure servers and sites)    Not at all View Results

BRUSSELS, Belgium (IDG) -- Today's news is filled with images of downed planes, captured soldiers, and refugees in Kosovo. But there is another war being waged, one that pits pro-Serbian hackers against U.S. and NATO computers.

The same week a U.S. F-117A stealth fighter was lost over Yugoslavia, a NATO Web server here was shot down by denial-of-service attacks, which NATO sources strongly suspect came from the Serbian military, not independent hackers.

In the U.S., the Navy's Web site was hacked, reportedly by Russians who support the Serbs. Erasing the Navy's information, they left blisteringly obscene insults against the U.S.

Russian hackers - or people claiming to be Russian hackers - also struck Web sites such as one maintained by Orange Coast College, leaving the messages "Asses out of Serbia" and "Russian hackers demand to stop terrorist aggression against Yugoslavia." They also lobbed a few insults at Bill Clinton and Monica Lewinsky.

All week at NATO headquarters here, the network staff was countering Serbian assaults on the NATO.int Web site and the e-mail server. After a denial-of-service attack based on "ping" saturations launched from Serbia brought down the NATO server, NATO personnel took evasive action.

MORE COMPUTING INTELLIGENCE
	IDG.net home page
Industry Standard home page
Industry Standard email newsletters
Industry Standard daily Media Grok
Industry Standard financial news
Reviews & in-depth info at IDG.net
IDG.net's personal news page
Questions about computers? Let IDG.net's editors help you
Subscribe to IDG.net's free daily newsletter for computer industry cognoscenti
Search IDG.net in 12 languages
News Radio
	Fusion audio primers
	Computerworld Minute

A ping attack is a malicious saturation of a server with messages that overwhelm the server's capacity to respond. To counter it, the NATO network crew swapped out a Sun SPARC 20 for the more powerful UltraSPARC for faster processing of the Serbian pings. And NATO switched from a 256K bit/sec access line to the European equivalent of a T-1 to keep the pings from eating up bandwidth.

"We have about 100 servers, and we're afraid all the NATO sites have been attacked," says NATO's Webmaster, Baul Magis. Though NATO's public server was knocked out, no internal part of the NATO intranet is believed to have been compromised. But NATO's mail servers are taking a beating, getting hit with more than 10,000 e-mails per day - many infected with dangerous computer viruses.

NATO is bombing Serbia, a Yugoslavian republic, to stop the Serbs from forcing ethnic Albanians from Kosovo. Magis said most of the e-mail NATO is getting, particularly from Serbia and Russia, expresses opposition to the airstrikes. "But we're also getting messages from Kosovars that express support for NATO," he adds.

Magis says NATO headquarters won't launch an electronic counterstrike. "We want to show we're more civilized," he says. "We believe in freedom of speech." NATO is even discussing the possibility of hosting Serbian information on the Web so the Serbs can share their views.

The attack on the U.S. Navy hit the Navy's Medical Information Management page at navy.mil, says Alan Goldstein, the Navy's director of technology integration in Bethesda, Md.

No one apparently got any farther into Navy systems, but no one there is resting. "This is going to go on for quite a while," Goldstein says.

Ellen Messmer is a senior editor for Network World Fusion.